HN user

irfan

173 karma

CTO & Co-Founder FootMetrics (footmetrics.xyz)

http://i.com.pk/

[ my public key: https://keybase.io/irfan; my proof: https://keybase.io/irfan/sigs/MtSoLiEraNSdMn7Ddp-2-6tDeK9u4r1Rd5_Zhl8UVl0 ]

Posts9
Comments32
View on HN

I had been downloading the zone file for .PK domains on daily bases until they blocked the zone transfers. Based on comparison of these daily zone files I managed to publish the statistics [1] and also broke the news about hacked .PK domains [2] which was picked up by all leading tech blogs and news agencies.

Currently, I cannot find a way to get the zone file even by officially requesting the registry manager.

[1] https://www.i.com.pk/pknic-domain-registration-statistics/

[2] https://www.i.com.pk/110-pk-domains-managed-by-markmonitor-g...

The app uses parse.com API for all communication (and probably for all data storage) and I haven't seen it communicating with anything other than parse, getsentry and flurry services.

Does hacking the app means hacking parse.com?

In 2007 I did the same level of digging with a facebook puzzle solving game. Game used to post daily puzzles and top scorers (solving the puzzle in minimum time) were shown on global leaderboard. At that time, the app was not using any kind of hashing or validation. It was simply posting the score to the server so tempering the data was easier. After staying on top of global leaderboard for a few days (with impossible score of 1 second), the app developer contacted me and requested to stop cheating the system. I suggested him some changes and the game became much better

There are 975 .Pk domains registered by MarkMonitor. google, visa, PayPal, sony, zynga, microsoft, hp all rely on MarkMonitor for their identity in Pakistan. It seems that MarkMonitor's account with pknic was compromised. 110 .PK domains had their name servers changed to freehostia.com recently. All of them registered by MarkMonitor. Here is the list: http://i.com.pk/110-pk-domains-managed-by-markmmonitor-got-h... [note: this list was compiled by me]

I had a similar problem when using SSL connections. I'm not sure about your data by in my case the data was pretty much public data and there was no harm in using simple HTTP connection. This significantly improved the speed and no more very frequent timeouts.

Also try enabling/disabling gzip compression for API calls.

"Django makes it extremely easy to generate database queries, which is both a good and bad thing"

I experienced this when a junior developer made queries in a loop inside template without realizing that it is actually going to be a lot of SQL queries in the end.

I agree with the argument * People will get your data if they want it* Reading the discussion here and on original post, I can make a scraper that would be difficult to detect and block ;-)